There are at least four denominations of key systems in the automotive industry: (a) a physical key which requires the physical key for entry and to start the engine; (b) a physical key with an RFID (Radio Frequency Identification) immobilizer which requires the physical key for entry and the physical key plus RFID to start the engine; (c) a keyless entry with an RFID immobilizer which may permit remote active entry [e.g., pressing a button(s) on the vehicle door] and requires the physical key plus RFID to start the engine; and (d) a passive keyless entry and start (PKES) which may permit remote passive entry and start [e.g., entry and start automated; pressing of button(s) may not be required to enter or start the vehicle].
PKES systems may be prone to relay attacks. Under normal operating conditions, PKES systems may automatically unlock and start the vehicle when the vehicle user (often carrying a vehicle keyfob) is within a prescribed proximity of the vehicle. In relay attacks, the vehicle may be unlocked and started when the vehicle user is not within the appropriate proximity of the vehicle. The use of relay signals trick the vehicle into concluding that the vehicle user is within the prescribed proximity and thus performs the automated unlock and start functionality. Therefore, thieves may gain entry to the vehicle. FIG. 1 illustrates one example of a relay attack. FIG. 1 shows a vehicle 1 equipped with a PKES system having a vehicle receiver/transmitter 2; a vehicle keyfob 3 being carried by the vehicle's owner or other authorized user 4; and a first and second thief 5,6. The first thief 5 may place a fixed repeater (FR) 7 near the target vehicle 1 and the second thief 6 may carry a mobile repeater (MR) 8. The repeater is a device which may receive and retransmit the signal (i.e., relay the signal). It may contain a processor and a modem; thus, the received signal may be modulated prior to being retransmitted (e.g., to a different frequency, encoded, etc.). In addition, the repeaters 7, 8 may communicate wirelessly or by wire. In any case, the first thief 5 first acquires an interrogation signal from the vehicle 1. This may be accomplished by merely placing the FR 7 near the vehicle 1 in systems that periodically or continuously transmit an interrogation signal via the vehicle receiver/transmitter 2. In some systems, the interrogation signal is emitted by the receiver/transmitter 2 once the vehicle door handle is lifted. Upon acquisition of the interrogation signal, the FR 7 sends the signal to the MR 8. Provided the second thief 6 is close enough to the victim 4, the keyfob 3 will respond to the interrogation signal sent from the MR 8—being tricked into believing that the vehicle 1 must be nearby. The keyfob 3 sends a reply signal which is in turn captured by the MR 8 and relayed to the FR 7, which in turn relays it to the vehicle 1 where it is received by the receiver/transmitter 2. The receiver/transmitter 2 then validates the signal and unlocks the vehicle doors. For some keyless systems, a similar process may be performed in order to start the vehicle 1. In some instances, the vehicle doors must first be closed before the vehicle 1 will send an interrogation signal via the receiver/transmitter 2; in some systems, a start button inside the vehicle 1 must be actuated first. Furthermore, in some PKES systems, there are multiple transmissions between the receiver/transmitter 2 and the keyfob 3 prior to unlocking the vehicle doors or starting the vehicle 1 (e.g., first a wake-up signal from the receiver/transmitter 2 and an acknowledgement signal from the keyfob 3; then an interrogation signal from the receiver/transmitter 2 and then a reply signal from the keyfob 3). Also, while there is generally only one FR 7 required, thieves may use multiple MRs 8. The MR(s) 8 may be strategically positioned rather than carried by the thief 6 (e.g., near one or more entrances or hallways where the victim 4 is likely to walk after exiting the vehicle 1). In wireless repeater systems, the range of reception/transmission may vary depending upon such factors as design and environment. Regardless, the MR 8 typically does not need to be extremely close to the victim's keyfob 3 (e.g., 10-15 meters away) making the relay attacked all the more covert.
A PKES system is one type of a passive keyless (PK) system in which a keyfob, as defined herein, is used to passively authorize a user, carry out a vehicle function (e.g., door unlock), or both. As used herein, PK systems include passive keyless entry and start (PKES) systems, passive keyless entry (PKE) systems (without passive start), as well as passive keyless start (PKS) systems that may not provide for passive entry. Thus, it will also be appreciated that a PK system may include use of a key or require other user action for either entry or vehicle start (ignition-on).